Skip to main content
ALT Linux Bugzilla
– Attachment 22159 Details for
Bug 60480
CVE-2023-54391: обход аутентификации в pve-access-control, неаутентифицированный доступ как root@pam
New bug
|
Search
|
[?]
|
Help
Register
|
Log In
[x]
|
Forgot Password
Login:
[x]
|
EN
|
RU
[patch]
Stop-gap из PSA-2026-00043-1: валидация tfa-challenge перед ранними выходами
cve-2023-54391.patch (text/plain), 436 bytes, created by
Denis
on 2026-09-09 23:49:12 MSK
(
hide
)
Description:
Stop-gap из PSA-2026-00043-1: валидация tfa-challenge перед ранними выходами
Filename:
MIME Type:
Creator:
Denis
Created:
2026-09-09 23:49:12 MSK
Size:
436 bytes
patch
obsolete
>--- a/src/PVE/AccessControl.pm >+++ b/src/PVE/AccessControl.pm >@@ -737,6 +737,7 @@ > my $plugin = PVE::Auth::Plugin->lookup($cfg->{type}); > > if ($tfa_challenge) { >+ verify_ticket($tfa_challenge, 0, $username); > # This is the 2nd factor, use the password for the OTP response. > my $tfa_challenge = authenticate_2nd_new($username, $realm, $password, $tfa_challenge); > return wantarray ? ($username, $tfa_challenge) : $username;
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=22159">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 60480
: 22159 |
22160
